Decentralization financial platform loan intelligent contract vulnerability detection method and system based on graph neural network

Abstract

The invention relates to the technical field of software security, in particular to a decentralized financial platform loan intelligent contract vulnerability detection method and system based on a graph neural network, and the method comprises the steps: collecting intelligent contract source code data, and carrying out the vulnerability marking of the intelligent contract source code data according to whether there is a vulnerability in the data; compiling intelligent contract source code data into an abstract syntax tree, and constructing a contract code heterogeneous graph; constructing a graph neural network model, and performing vulnerability prediction training on the graph neural network model by using the contract code heterogeneous graph to obtain an intelligent contract vulnerability detection model, the graph neural network model captures structural features of a contract code heterogeneous graph layer by layer by using a hierarchical attention enhancement mechanism and predicts and identifies vulnerabilities in contract codes based on the structural features; and converting the to-be-detected smart contract source code into a target contract code heterogeneous graph to perform vulnerability prediction on the target contract code heterogeneous graph. According to the method, the semantics and data flow characteristics of the contract can be accurately captured, and efficient and accurate detection of the intelligent contract vulnerability is realized.

Description

Technical Field

[0001] The present invention relates to the field of software security technology, and in particular to a method and system for detecting vulnerabilities in a decentralized financial platform lending smart contract based on a graph neural network. Background Art

[0002] In recent years, blockchain technology and decentralized finance (DeFi) platforms have developed rapidly. DeFi platforms use the technical advantages of blockchain such as decentralization and immutability of content, and use smart contract systems to complete financial services such as loans, transactions, and derivatives, showing users a new financial model. However, the actual application of smart contracts has brought huge security challenges. Because they run in a more open and transparent blockchain, the technical defects of smart contract programs are easier to discover and apply.

[0003] As a cutting-edge deep learning technology, Graph Neural Networks (GNNs) are good at processing graph-structured data and can accurately model code. Using GNNs for automated and intelligent smart contract code analysis is expected to improve the efficiency and accuracy of vulnerability detection, thereby more effectively addressing security challenges in the field of decentralized finance (DeFi). Traditional security analysis methods used for smart contracts, such as rule-based static analysis methods, have limited coverage and are prone to false positives and false negatives. This type of method scans and matches smart contracts through predefined vulnerability patterns and code rules, but cannot adapt to the ever-changing attack methods and complex contract logic, resulting in low detection accuracy and efficiency. Another example: methods based on symbolic execution and formal verification require a lot of manual intervention and expert knowledge, and are not highly applicable and automated. This type of method formally models and reasoned about the semantics and behavior of smart contracts, but requires manual definition of complex constraints and assertion rules, which requires high professional capabilities of users and is difficult to apply on a large scale. For example, most vulnerability detection methods based on deep learning convert smart contract codes into simple sequence representations, ignoring the structural information and semantic relationships of the code, making it difficult to accurately characterize the characteristics and vulnerability patterns of the contract, resulting in limited detection performance. Existing visualization support for smart contract vulnerability detection is insufficient, making it difficult to provide intuitive and actionable vulnerability analysis results and repair suggestions, which is not conducive to developers quickly locating and repairing vulnerabilities, and cannot meet the needs of contract auditing and risk assessment. In decentralized financial scenarios, it is often difficult to meet the needs of smart contract vulnerability detection. These traditional methods are insufficient in processing complex data attributes such as data flow and permission control, which in turn affects the accuracy and efficiency of the detection results. Summary of the invention

[0004] To this end, the present invention provides a decentralized financial platform lending smart contract vulnerability detection method and system based on graph neural network, which uses GNNs to perform representation learning of smart contracts, can reveal potential patterns in the code, and accurately capture the semantics and data flow characteristics of the contract, thereby automatically identifying reentrancy and timestamp dependency vulnerabilities in the lending contract, and realizing efficient and accurate detection and classification of smart contract vulnerabilities.

[0005] According to the design scheme provided by the present invention, on the one hand, a method for detecting vulnerabilities in a decentralized financial platform lending smart contract based on a graph neural network is provided, comprising:

[0006] Collect smart contract source code data, and mark vulnerabilities in the smart contract source code data according to whether there are vulnerabilities in the data; and compile the smart contract source code data into an abstract syntax tree, so as to use the abstract syntax tree to construct a contract code heterogeneous graph for describing the entity relationship and interaction mode of the smart contract source code;

[0007] Construct a graph neural network model, use the contract code heterogeneous graph to train the graph neural network model for vulnerability prediction, and obtain a smart contract vulnerability detection model, wherein the graph neural network model uses a hierarchical attention enhancement mechanism to capture the structural features of the contract code heterogeneous graph layer by layer and predict and identify vulnerabilities in the contract code based on the structural features;

[0008] The source code of the smart contract to be tested is converted into a heterogeneous graph of the target contract code, and the smart contract vulnerability detection model is used to predict vulnerabilities in the heterogeneous graph of the target contract code.

[0009] As a decentralized financial platform lending smart contract vulnerability detection method based on graph neural network of the present invention, further, the smart contract source code data is compiled into an abstract syntax tree, including:

[0010] Preprocessing the smart contract source code data, including formatting, comment removal, and identifier renaming;

[0011] The compiler is used to parse the preprocessed smart contract source code into an abstract syntax tree, in which each node corresponds to a syntax element.

[0012] As a decentralized financial platform lending smart contract vulnerability detection method based on graph neural network of the present invention, further, an abstract syntax tree is used to construct a contract code heterogeneous graph for describing the entity relationship and interaction mode of the smart contract source code, including:

[0013] Extracting the grammatical information and semantic information of the smart contract source code in the abstract syntax tree, wherein the grammatical information includes the variable declaration node type, function definition node type, modifier node type, expression statement node type, and control flow statement node type in the abstract syntax tree, and the semantic information includes the control flow edge used to represent the order of code execution, the data flow edge used to represent the definition and use relationship of code variables, and the call edge used to represent the call relationship between functions;

[0014] The syntactic information and semantic information of smart contract source code are uniformly modeled into the contract code heterogeneous graph.

[0015] As a decentralized financial platform lending smart contract vulnerability detection method based on graph neural network of the present invention, further, the graph neural network model includes: a heterogeneous graph attention unit, a graph pooling layer and a graph classification layer, wherein the heterogeneous graph attention unit includes: a node embedding layer for mapping heterogeneous graph nodes into initial feature vectors, a heterogeneous graph attention layer for capturing the structural features of the contract code heterogeneous graph layer by layer using a hierarchical attention enhancement mechanism, a graph representation learning layer for aggregating node structural features to generate a heterogeneous graph feature representation, and a prediction output layer for mapping the heterogeneous graph feature representation into a probability distribution of vulnerability types using softmax, the graph pooling layer is used to aggregate the node features under each edge type using the importance score of the node under the specified edge type and obtain a graph representation at the relationship level, and obtain the final output graph representation by aggregating the graph representations under different edge types, and the graph classification layer is used to input the final output graph representation into a multi-layer perceptron to use the multi-layer perceptron to predict and identify the vulnerability type in the smart contract source code.

[0016] As a decentralized financial platform lending smart contract vulnerability detection method based on graph neural network of the present invention, further, a hierarchical attention enhancement mechanism is used to capture the structural features of the heterogeneous graph of the contract code layer by layer, including:

[0017] At the level of the current captured structural features, for each heterogeneous graph node, the attention weight is calculated according to the type and features of the neighboring nodes, and the features of the neighboring nodes are weighted and summed using the attention weight to generate aggregate features. The current features of the current layer nodes are concatenated or added with the aggregate features, and the nonlinear activation function ReLU is used to obtain the node features in the next captured structural feature level. This is iterated until the number of iterations is greater than the preset number of feature capture layers, and the node features in the last captured structural feature layer are used as the structural features of the contract code heterogeneous graph.

[0018] As a decentralized financial platform lending smart contract vulnerability detection method based on graph neural network of the present invention, further, the graph representation finally output by the graph pooling layer is represented as: Among them, γ ris the importance score of relation r, is the set of relations in the heterogeneous graph, h r is the aggregate node representation under relation r, and is a set of heterogeneous graph nodes, is the importance score of node vi under relation r.

[0019] As a decentralized financial platform lending smart contract vulnerability detection method based on graph neural network of the present invention, further, the graph neural network model is trained for vulnerability prediction using the heterogeneous graph of the contract code, including:

[0020] Use the cross entropy loss function as the vulnerability prediction training objective function;

[0021] Based on the vulnerability prediction training objective function, the graph neural network model is trained and optimized through the gradient back propagation optimization algorithm until the model converges or reaches the maximum number of training optimization iterations, so that the trained graph neural network model can be used as the smart contract vulnerability detection model.

[0022] On the other hand, the present invention also provides a decentralized financial platform lending smart contract vulnerability detection system based on graph neural network, comprising: a sample collection module, a model training module and a vulnerability detection module, wherein:

[0023] The sample collection module is used to collect smart contract source code data, mark vulnerabilities in the smart contract source code data according to whether there are vulnerabilities in the data; and compile the smart contract source code data into an abstract syntax tree, so as to use the abstract syntax tree to construct a contract code heterogeneous graph for describing the entity relationship and interaction mode of the smart contract source code;

[0024] A model training module is used to construct a graph neural network model, and use the heterogeneous graph of contract code to perform vulnerability prediction training on the graph neural network model to obtain a smart contract vulnerability detection model, wherein the graph neural network model uses a hierarchical attention enhancement mechanism to capture the structural features of the heterogeneous graph of contract code layer by layer and predict and identify vulnerabilities in the contract code based on the structural features;

[0025] The vulnerability detection module is used to convert the smart contract source code to be detected into a target contract code heterogeneous graph, and use the smart contract vulnerability detection model to predict vulnerabilities in the target contract code heterogeneous graph.

[0026] Beneficial effects of the present invention:

[0027] 1. The present invention introduces a hierarchical attention mechanism to enhance the graph neural network model, calculates the attention weights at the node level, edge level and subgraph level respectively, dynamically adjusts the contribution of different code elements and structures to vulnerability detection, enables the model to adaptively focus on important vulnerability-related features, improves the accuracy and generalization ability of detection, and makes up for the lack of attention mechanism in the existing graph neural network model. It can graphically display the code structure, control flow and data flow relationship of the contract, intuitively present the key code areas and potential vulnerabilities that the model focuses on, and provide automatically generated vulnerability analysis reports and repair suggestions, which greatly improves the interpretability and operability of vulnerability detection results, and facilitates developers to quickly understand, locate and repair vulnerabilities. .

[0028] 2. The present invention adopts a method based on heterogeneous graph representation and attention-enhanced graph neural network, which can automatically learn and extract the deep-level features and structural relationships of smart contract codes, overcome the limitations of manually defined rules, significantly improve the accuracy, recall rate and generalization ability of vulnerability detection, and reduce the risks of false positives and negatives.

[0029] 3. The present invention provides an end-to-end deep learning method that does not require manual definition of complex constraints and assertion rules, greatly reducing the professional ability requirements of users, improving the automation and ease of use of vulnerability detection, and realizing efficient analysis and real-time detection of large-scale smart contracts. BRIEF DESCRIPTION OF THE DRAWINGS

[0030] Figure 1 The following is a schematic diagram of the vulnerability detection process of the decentralized financial platform lending smart contract based on the graph neural network in the embodiment;

[0031] Figure 2 This is a schematic diagram of the model training algorithm principle in the embodiment;

[0032] Figure 3 The system architecture in the embodiment is shown in FIG. DETAILED DESCRIPTION

[0033] In order to make the purpose, technical solutions and advantages of the present invention clearer and more understandable, the present invention is further described in detail below in conjunction with the accompanying drawings and technical solutions.

[0034] First, the technical terms involved in the embodiments of this case are explained as follows:

[0035] Decentralized financial platform (DeFi): An open, transparent, decentralized financial ecosystem built based on blockchain technology and smart contracts, providing traditional financial services such as lending, trading, and insurance. Smart contract: A self-executing contract running on the blockchain, with contract terms written in code, automatically executed when the triggering conditions are met, without the involvement of an intermediary, and with the characteristics of being tamper-proof and traceable. Ethereum: An open source public blockchain platform that supports the Turing-complete smart contract programming language Solidity and is currently the largest decentralized application (DApp) operating environment. Graph neural network (GNN): A deep learning model for processing graph-structured data. It learns the feature representation of nodes by recursively aggregating the neighborhood information of nodes, and generates graph-level representations through operations such as graph pooling, which are used for tasks such as graph classification and prediction. Attention mechanism: Originated from the field of natural language processing, it dynamically adjusts the contribution of different input components to the output by calculating the correlation weights between them, enhancing the model's ability to process long sequences and capture long-distance dependencies. Heterogeneous graph: A graph containing multiple types of nodes and multiple types of edges, which can represent complex entity relationships and interaction patterns, such as the smart contract code graph in the present invention, which contains different types of nodes such as variables, functions, code blocks, and different types of edges such as control flow and data flow. Vulnerability analysis report: A structured analysis report automatically generated based on the vulnerability detection results of the smart contract, including vulnerability type, severity, code location, exploitation scenario, repair suggestions, etc., to guide developers to repair vulnerabilities and strengthen security. Solidity: The mainstream development language of Ethereum smart contracts, which draws on the syntax features of languages ​​such as C++ and Python, supports advanced functions such as inheritance, libraries, and user-defined types, but also introduces specific security vulnerabilities. Blockchain security: Focuses on the security and privacy of blockchain systems and decentralized applications, involving technical challenges and protective measures at multiple levels such as consensus protocols, smart contracts, cryptographic algorithms, and privacy protection.

[0036] In view of the security issues in the field of decentralized finance (DeFi), the embodiments of the present invention refer to Figure 1 As shown, a method for detecting vulnerabilities in smart contracts for lending on decentralized financial platforms based on graph neural networks is provided, comprising:

[0037] S101. Collect smart contract source code data, mark vulnerabilities in the smart contract source code data according to whether there are vulnerabilities in the data; and compile the smart contract source code data into an abstract syntax tree, so as to use the abstract syntax tree to construct a contract code heterogeneous graph for describing the entity relationship and interaction mode of the smart contract source code.

[0038] Specifically, the smart contract source code data is compiled into an abstract syntax tree, which can be designed to include:

[0039] Preprocessing the smart contract source code data, including formatting, comment removal, and identifier renaming;

[0040] The compiler is used to parse the preprocessed smart contract source code into an abstract syntax tree, in which each node corresponds to a syntax element.

[0041] Compile the smart contract source code into an abstract syntax tree (AST). AST is a tree structure that represents the syntax structure of the program code. Each AST node corresponds to a syntax element, such as a variable declaration, function definition, expression, etc. AST can be generated by a Solidity compiler or a syntax analysis tool.

[0042] Among them, the abstract syntax tree is used to construct a heterogeneous contract code graph for describing the entity relationship and interaction mode of the smart contract source code, which may include:

[0043] Extracting the grammatical information and semantic information of the smart contract source code in the abstract syntax tree, wherein the grammatical information includes the variable declaration node type, function definition node type, modifier node type, expression statement node type, and control flow statement node type in the abstract syntax tree, and the semantic information includes the control flow edge used to represent the order of code execution, the data flow edge used to represent the definition and use relationship of code variables, and the call edge used to represent the call relationship between functions;

[0044] The syntactic information and semantic information of smart contract source code are uniformly modeled into the contract code heterogeneous graph.

[0045] Construct a heterogeneous contract graph based on AST. A heterogeneous contract graph is a heterogeneous graph in which there are multiple types of nodes and edges. Specifically, the node types of the heterogeneous contract graph include AST node types such as variable declarations, function definitions, modifiers, expression statements, and control flow statements. The edge types of the heterogeneous contract graph include control flow edges, data flow edges, call edges, etc. The control flow edge represents the order of code execution, the data flow edge represents the definition and usage relationship of the variable, and the call edge represents the call relationship between functions. Through this heterogeneous graph representation, the syntax and semantic information of the smart contract are uniformly modeled into the graph structure.

[0046] S102. Construct a graph neural network model, and use the contract code heterogeneous graph to perform vulnerability prediction training on the graph neural network model to obtain a smart contract vulnerability detection model, wherein the graph neural network model uses a hierarchical attention enhancement mechanism to capture the structural features of the contract code heterogeneous graph layer by layer and predict and identify vulnerabilities in the contract code based on the structural features.

[0047] Specifically, the graph neural network model can be designed to include: a heterogeneous graph attention unit, a graph pooling layer and a graph classification layer, wherein the heterogeneous graph attention unit includes: a node embedding layer for mapping heterogeneous graph nodes into initial feature vectors, a heterogeneous graph attention layer for capturing the structural features of the contract code heterogeneous graph layer by layer using a hierarchical attention enhancement mechanism, a graph representation learning layer for aggregating node structural features to generate a heterogeneous graph feature representation, and a prediction output layer for mapping the heterogeneous graph feature representation into a probability distribution of vulnerability types using softmax, the graph pooling layer is used to aggregate the node features under each edge type using the importance score of the node under the specified edge type and obtain a graph representation at the relationship level, and obtain the final output graph representation by aggregating graph representations under different edge types, and the graph classification layer is used to input the final output graph representation into a multi-layer perceptron to use the multi-layer perceptron to predict and identify the vulnerability type in the smart contract source code.

[0048] Among them, the hierarchical attention enhancement mechanism is used to capture the structural features of the heterogeneous graph of contract codes layer by layer, which can include:

[0049] At the level of the current captured structural features, for each heterogeneous graph node, the attention weight is calculated according to the type and features of the neighboring nodes, and the features of the neighboring nodes are weighted and summed using the attention weight to generate aggregate features. The current features of the current layer nodes are concatenated or added with the aggregate features, and the nonlinear activation function ReLU is used to obtain the node features in the next captured structural feature level. This is iterated until the number of iterations is greater than the preset number of feature capture layers, and the node features in the last captured structural feature layer are used as the structural features of the contract code heterogeneous graph.

[0050] Input heterogeneous contract graph The node set is Parse the smart contract source code into an abstract syntax tree (AST), and then convert the AST into a heterogeneous contract graph Heterogeneous Contract Graph Contains multiple types of nodes (such as statements, expressions, etc.) and edges (such as control flow, data flow, etc.). The graph structure can be represented using an adjacency matrix or adjacency list.

[0051] Depending on the type and attributes of the node, a pre-trained word embedding model or random initialization is used to generate the node feature vector. For composite nodes, the average or pooling result of the feature vectors of its child nodes can be used as the initial feature.

[0052] Initialize the number of iterations l: = 1. Heterogeneous graph attention layer Use the node features of the current layer and graph structure To update the node features, get the node features of the next layer For each node v, the attention weight is calculated based on the type and features of its neighbor nodes. The features of the neighbor nodes are weighted and summed using the attention weights to generate aggregate features. The current features of the node are concatenated or added to the aggregate features and passed through the nonlinear activation function ReLU. The output result is the updated node features:

[0053]

[0054] The number of iterations increases by one:

[0055] l:=l+1 (2)

[0056] And determine whether the current iteration number l is greater than the preset number of layers L. If l≤L, return to step 4 and continue to update the node features of the next layer. If l>L, enter the graph representation learning layer.

[0057] In the graph representation learning layer, the readout function is used to aggregate the node features x of the last layer. (L) v, generates a representation of the entire contract graph

[0058]

[0059] The prediction output layer represents the graph Probability distribution mapped to vulnerability types Use the softmax function for normalization. Use multiple fully connected layers to represent the graph Mapped to an output vector. Apply the softmax function to the output vector to get the probability distribution of vulnerability types

[0060]

[0061] Among them, using the heterogeneous graph of contract code to train the graph neural network model for vulnerability prediction may include:

[0062] Use the cross entropy loss function as the vulnerability prediction training objective function;

[0063] Based on the vulnerability prediction training objective function, the graph neural network model is trained and optimized through the gradient back propagation optimization algorithm until the model converges or reaches the maximum number of training optimization iterations, so that the trained graph neural network model can be used as the smart contract vulnerability detection model.

[0064] like Figure 2 As shown, the cross entropy loss function L is used in the loss function calculation stage to measure the predicted probability distribution The difference between the actual label y. Use the one-hot encoding of the actual label y and the predicted probability distribution Compute the cross entropy loss. The loss is averaged over all examples in the batch:

[0065]

[0066] The gradient back-propagation optimization phase updates the model parameters θ by minimizing the loss function L, using the gradient descent method with a learning rate of η. The gradient of the loss function L with respect to the model parameters θ is calculated. Update the model parameters using gradient descent:

[0067]

[0068] Determine whether the model has converged or reached the preset maximum number of iterations. If yes, end the training; if not, return to the step heterogeneous graph attention layer and continue the next round of iteration.

[0069] In the graph pooling layer, node representations are first aggregated under each edge type:

[0070]

[0071] in is a collection of nodes, is node v i Importance score under relation r:

[0072]

[0073] MLP r is a relation-specific multilayer perceptron. This step obtains a relation-level graph representation

[0074] Then, we further aggregate the graph representations of different relations:

[0075]

[0076] where γ r is the importance score of relation r:

[0077]

[0078] In the graph classification layer, the graph is represented by h G Input into the multi-layer perceptron to predict whether the smart contract has a specific type of vulnerability:

[0079]

[0080] in is the predicted probability of the vulnerability class, and C is the number of vulnerability types.

[0081] S103: Convert the source code of the smart contract to be detected into a target contract code heterogeneous graph, and use the smart contract vulnerability detection model to predict vulnerabilities in the target contract code heterogeneous graph.

[0082] In the embodiment of this case, the smart contract is compiled into an abstract syntax tree, and a heterogeneous contract graph based on AST is constructed. The nodes and edges in the heterogeneous contract graph have different types, corresponding to the syntax elements and semantic relationships of the smart contract. The initial embedding representation of the node is learned according to the node type, and the node embedding is updated through a multi-layer heterogeneous graph attention layer. The heterogeneous graph attention layer comprehensively utilizes node embedding, edge embedding, and the heterogeneity of nodes and edges, and uses different attention heads and weight matrices to calculate the attention weights of nodes on different types of edges, thereby adaptively aggregating the information of neighboring nodes. A hierarchical attention pooling mechanism based on relationships and node types is used to adaptively aggregate the node embeddings of the heterogeneous contract graph to obtain a hierarchical graph representation. The graph representation is input into the graph classification layer to predict whether there are specific types of vulnerabilities in the smart contract. Through the above technical means, the scheme of this case can make full use of the structured representation of the smart contract source code and the heterogeneous information of nodes and edges, effectively extract the syntax and semantic features of the smart contract, thereby improving the accuracy of vulnerability detection, and can be used in scenarios such as security auditing and vulnerability mining of smart contracts to improve the security and credibility of blockchain applications.

[0083] Furthermore, based on the above method, an embodiment of the present invention also provides a decentralized financial platform lending smart contract vulnerability detection system based on graph neural network, comprising: a sample collection module, a model training module and a vulnerability detection module, wherein:

[0084] The sample collection module is used to collect smart contract source code data, mark vulnerabilities in the smart contract source code data according to whether there are vulnerabilities in the data; and compile the smart contract source code data into an abstract syntax tree, so as to use the abstract syntax tree to construct a contract code heterogeneous graph for describing the entity relationship and interaction mode of the smart contract source code;

[0085] A model training module is used to construct a graph neural network model, and use the heterogeneous graph of contract code to perform vulnerability prediction training on the graph neural network model to obtain a smart contract vulnerability detection model, wherein the graph neural network model uses a hierarchical attention enhancement mechanism to capture the structural features of the heterogeneous graph of contract code layer by layer and predict and identify vulnerabilities in the contract code based on the structural features;

[0086] The vulnerability detection module is used to convert the smart contract source code to be detected into a target contract code heterogeneous graph, and use the smart contract vulnerability detection model to predict vulnerabilities in the target contract code heterogeneous graph.

[0087] During system deployment and application, Figure 3As shown, it can be designed to include the following module contents:

[0088] (1) Smart contract source code: Collect and annotate a large number of decentralized financial platform lending smart contract source codes, format the source code, remove comments, rename identifiers, and other preprocessing to improve the consistency and analyzability of the code. Manually review and annotate the smart contract source code to identify the types and locations of vulnerabilities and form a high-quality training data set.

[0089] (2) Contract management module: Develop a user-friendly interface that allows users to upload, browse, and manage smart contract source code. Provide contract search and filtering functions, and support queries based on keywords, timestamps, vulnerability types, and other conditions.

[0090] (3) Heterogeneous graph construction module: Parse the preprocessed smart contract source code into an abstract syntax tree (AST). Build a heterogeneous contract graph based on AST. The node types include statements, expressions, variables, and functions. The edge types include control flow, data flow, and call relationships. Implement an automated graph construction process to support smart contracts in different languages ​​and frameworks. Use a graph database to manage heterogeneous contract graphs.

[0091] (4) Attention-enhanced graph classification module: The performance of graph classification is enhanced through the attention mechanism. A hierarchical attention mechanism is designed to calculate the attention weights at the node level, edge level, and subgraph level to capture the important features of the contract structure. An adaptive attention weight adjustment strategy is implemented to dynamically adjust the attention calculation method according to the characteristics of the task and the distribution of the data.

[0092] (5) Graph neural network module: Implement a graph neural network model based on message passing and aggregation. Design feature learning and propagation mechanisms for heterogeneous graphs, considering the semantic information of different types of nodes and edges. Develop graph pooling and readout operations, support variable-sized contract graph input, and generate contract-level embedding representations.

[0093] (6) Data storage module: Design the storage architecture of smart contract data to support efficient storage and retrieval of structured and unstructured data. Use a relational database to store the metadata, version information, and analysis results of the contract. Use a document database to store the source code, AST, and graph structure data of the contract.

[0094] (7) Visual interaction module: Develop a web interface to provide intuitive and interactive smart contract analysis and vulnerability detection functions. Develop a vulnerability analysis report component to automatically generate vulnerability analysis results for the contract, including vulnerability type, severity, code location, and other information. Implement the export and sharing functions of the analysis results, support multiple formats, and facilitate users to further process and report the analysis results.

[0095] The use of visual smart contract vulnerability analysis tools and interactive graph analysis components can greatly enhance the interpretability and operability of vulnerability detection results. Compared with the black-box detection results in existing methods, this system solution provides intuitive and fine-grained vulnerability visualization and automatically generated analysis reports, which facilitates developers to quickly understand, locate and repair vulnerabilities, and improves the efficiency of vulnerability response and repair.

[0096] Unless otherwise specifically stated, the relative steps, numerical expressions and values ​​of the components and steps set forth in these embodiments do not limit the scope of the present invention.

[0097] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the system disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0098] The units and method steps of each example described in conjunction with the embodiments disclosed herein can be implemented by electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. A person of ordinary skill in the art may use different methods to implement the described functions for each specific application, but such implementation is not considered to be beyond the scope of the present invention.

[0099] Those skilled in the art will appreciate that all or part of the steps in the above method can be completed by instructing related hardware through a program, and the program can be stored in a computer-readable storage medium, such as a read-only memory, a disk or an optical disk. Optionally, all or part of the steps in the above embodiment can also be implemented using one or more integrated circuits, and accordingly, each module / unit in the above embodiment can be implemented in the form of hardware or in the form of software function modules. The present invention is not limited to any specific form of combination of hardware and software.

[0100] Finally, it should be noted that the above-described embodiments are only specific implementations of the present invention, which are used to illustrate the technical solutions of the present invention, rather than to limit them. The protection scope of the present invention is not limited thereto. Although the present invention is described in detail with reference to the above-described embodiments, ordinary technicians in the field should understand that any technician familiar with the technical field can still modify the technical solutions recorded in the above-described embodiments within the technical scope disclosed by the present invention, or can easily think of changes, or make equivalent replacements for some of the technical features therein; and these modifications, changes or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present invention, and should be included in the protection scope of the present invention. Therefore, the protection scope of the present invention shall be subject to the protection scope of the claims.

Claims

1. A decentralized financial platform lending smart contract vulnerability detection method based on graph neural network, characterized in that: Include: Collect smart contract source code data and mark vulnerabilities in the smart contract source code data based on whether there are vulnerabilities in the data; Compile the smart contract source code data into an abstract syntax tree, and use the abstract syntax tree to construct a contract code heterogeneous graph for describing the entity relationships and interaction patterns of the smart contract source code; Construct a graph neural network model, use the contract code heterogeneous graph to train the graph neural network model for vulnerability prediction, and obtain a smart contract vulnerability detection model, wherein the graph neural network model uses a hierarchical attention enhancement mechanism to capture the structural features of the contract code heterogeneous graph layer by layer and predict and identify vulnerabilities in the contract code based on the structural features; The source code of the smart contract to be tested is converted into a heterogeneous graph of the target contract code, and the smart contract vulnerability detection model is used to predict vulnerabilities in the heterogeneous graph of the target contract code.

2. According to claim 1, the method for detecting vulnerabilities in decentralized financial platform lending smart contracts based on graph neural networks is characterized in that: Compile the smart contract source code data into an abstract syntax tree, including: Preprocessing the smart contract source code data, including formatting, comment removal, and identifier renaming; The compiler is used to parse the preprocessed smart contract source code into an abstract syntax tree, in which each node corresponds to a syntax element.

3. The method for detecting vulnerabilities in decentralized financial platform lending smart contracts based on graph neural networks according to claim 1 or 2, characterized in that: Use the abstract syntax tree to construct a heterogeneous contract code graph to describe the entity relationships and interaction patterns of the smart contract source code, including: Extracting the grammatical information and semantic information of the smart contract source code in the abstract syntax tree, wherein the grammatical information includes the variable declaration node type, function definition node type, modifier node type, expression statement node type, and control flow statement node type in the abstract syntax tree, and the semantic information includes the control flow edge used to represent the order of code execution, the data flow edge used to represent the definition and use relationship of code variables, and the call edge used to represent the call relationship between functions; The syntactic information and semantic information of smart contract source code are uniformly modeled into the contract code heterogeneous graph.

4. The method for detecting vulnerabilities in decentralized financial platform lending smart contracts based on graph neural networks according to claim 1 is characterized in that: The graph neural network model includes: a heterogeneous graph attention unit, a graph pooling layer and a graph classification layer, wherein the heterogeneous graph attention unit includes: a node embedding layer for mapping heterogeneous graph nodes into initial feature vectors, a heterogeneous graph attention layer for capturing the structural features of the contract code heterogeneous graph layer by layer using a hierarchical attention enhancement mechanism, a graph representation learning layer for aggregating node structural features to generate heterogeneous graph feature representations, and a prediction output layer for mapping heterogeneous graph feature representations into vulnerability type probability distributions using softmax, the graph pooling layer is used to aggregate node features under each edge type using the importance scores of nodes under a specified edge type and obtain a graph representation at the relationship level, and to obtain a final output graph representation by aggregating graph representations under different edge types, and the graph classification layer is used to input the final output graph representation into a multi-layer perceptron to use the multi-layer perceptron to predict and identify vulnerability types in smart contract source code.

5. The method for detecting vulnerabilities in decentralized financial platform lending smart contracts based on graph neural networks according to claim 1 or 4, characterized in that: The hierarchical attention enhancement mechanism is used to capture the structural features of the heterogeneous graph of contract code layer by layer, including: At the level of the current captured structural features, for each heterogeneous graph node, the attention weight is calculated according to the type and features of the neighboring nodes, and the features of the neighboring nodes are weighted and summed using the attention weight to generate aggregate features. The current features of the current layer nodes are concatenated or added with the aggregate features, and the nonlinear activation function ReLU is used to obtain the node features in the next captured structural feature level. This is iterated until the number of iterations is greater than the preset number of feature capture layers, and the node features in the last captured structural feature layer are used as the structural features of the contract code heterogeneous graph.

6. The method for detecting vulnerabilities in decentralized financial platform lending smart contracts based on graph neural networks according to claim 4 is characterized in that: The final output of the graph pooling layer is represented as follows: Among them, γ r is the importance score of relation r, is the set of relations in the heterogeneous graph, h r is the aggregate node representation under relation r, and is a set of heterogeneous graph nodes, For node v i The importance score under relation r.

7. The method for detecting vulnerabilities in decentralized financial platform lending smart contracts based on graph neural networks according to claim 1 is characterized in that: Using the heterogeneous graph of contract code to train the graph neural network model for vulnerability prediction, including: Use the cross entropy loss function as the vulnerability prediction training objective function; Based on the vulnerability prediction training objective function, the graph neural network model is trained and optimized through the gradient back propagation optimization algorithm until the model converges or reaches the maximum number of training optimization iterations, so that the trained graph neural network model can be used as the smart contract vulnerability detection model.

8. A decentralized financial platform lending smart contract vulnerability detection system based on graph neural network, characterized in that: It includes: sample collection module, model training module and vulnerability detection module, among which, The sample collection module is used to collect smart contract source code data, mark vulnerabilities in the smart contract source code data according to whether there are vulnerabilities in the data; and compile the smart contract source code data into an abstract syntax tree, so as to use the abstract syntax tree to construct a contract code heterogeneous graph for describing the entity relationship and interaction mode of the smart contract source code; A model training module is used to construct a graph neural network model, and use the heterogeneous graph of contract code to perform vulnerability prediction training on the graph neural network model to obtain a smart contract vulnerability detection model, wherein the graph neural network model uses a hierarchical attention enhancement mechanism to capture the structural features of the heterogeneous graph of contract code layer by layer and predict and identify vulnerabilities in the contract code based on the structural features; The vulnerability detection module is used to convert the smart contract source code to be detected into a target contract code heterogeneous graph, and use the smart contract vulnerability detection model to predict vulnerabilities in the target contract code heterogeneous graph.

9. An electronic device, characterized in that: include: at least one processor, and a memory coupled to the at least one processor; The memory stores a computer program, and the computer program can be executed by the at least one processor to implement the method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed, the method according to any one of claims 1 to 7 can be implemented.

Images